What are the challenges with STRIDE in modern cloud environments?

STRIDE still works as a mnemonic, but it predates the cloud (introduced ~1999): "as-a-Service" and serverless models shift who owns which threats, so the boundaries move even though the categories don't.

Challenges with STRIDE:

• The model is old — introduced by Microsoft around 1999, so by the 2020s it's 20-plus years old (still helpful as a mnemonic)
• Moving to cloud changes the threat landscape
• XY-aaS (Anything as a Service) models shift responsibilities
• Serverless architectures have different attack surfaces

Pizza as a Service analogy shows responsibility shifts:

Key insight: STRIDE still applies, but the boundaries and responsibilities change based on service model.